Page 1 of 3 123 LastLast
Results 1 to 10 of 21

Thread: Spam problem on a new installation

  1. #1
    SamTzu's Avatar
    SamTzu is offline Loyal Member
    Join Date
    Jan 2006
    Location
    Finland
    Posts
    83
    Rep Power
    9

    Default Spam problem on a new installation

    I just installed a new Zimbra (.18) for testing purposes on a branch office internal LAN network behind a firewall. I then opened a hole on the firewall on port 25 to test the installation. It worked. Today I find that lots of spam has been sent from that server (from yahoo.com.tw address mostly) even though It's only a day old and there has not been a mail server at that IP address previously. How is that possible? What can I do to block the hole?

    The mail server has the same name in DNS and host file.
    The mail server Internal network address is 10.10.x.y
    The mail server External network address is 217.25.x.y
    Firewall has NIC's & addresses on both networks.



    PS. The Joomla based PHP mailing component that I tested uses SMTP authentication with username and password.
    How can I see if the spam has come that way?
    Last edited by SamTzu; 07-17-2009 at 12:43 AM.
    SamTzu
    -----------------------------------------------
    "I keep hitting the esc key, why am I still here?"

  2. #2
    phoenix is offline Zimbra Consultant & Moderator
    Join Date
    Sep 2005
    Location
    Vannes, France
    Posts
    23,201
    Rep Power
    56

    Default

    How do you determine that spam has been sent from that server? Are there any local Windows PCs on that LAN? Have you checked the logs to see who has connected o that server?

    Opening port 25 in the firewall will not let anyone use that as a relay, by default Zimbra is not an open relay unless you've modified it to be one. Use a web 'open relay' checking service to see if your server is open.
    Regards


    Bill


    Acompli: A new adventure for Co-Founder KevinH.

  3. #3
    SamTzu's Avatar
    SamTzu is offline Loyal Member
    Join Date
    Jan 2006
    Location
    Finland
    Posts
    83
    Rep Power
    9

    Default

    There was over a 1500 mails in deferred que. (Mostly from that yahoo.com.tw address.)
    (Message count actually showed 250 k but I'm not sure that's accurate.)
    (Spam count for the same time shows 8.0 k.)

    It's a Linux only network.

    Still debugging and checking the logs.

    PS. How do you clear the mail que in Zimbra from command line?
    Last edited by SamTzu; 07-17-2009 at 01:05 AM.
    SamTzu
    -----------------------------------------------
    "I keep hitting the esc key, why am I still here?"

  4. #4
    uxbod's Avatar
    uxbod is offline Moderator
    Join Date
    Nov 2006
    Location
    UK
    Posts
    8,016
    Rep Power
    24

    Default

    Code:
    su - zimbra
    postsuper -d ALL
    That will delete everything in the mail queue. So onto why it may have allowed SPAMs to be sent. You can check whether you are a open relay using Mail relay testing. If it says its open then I would imagine it is down to the networks you have specified for Postfix so please post the following
    Code:
    su - zimbra
    zmprov gs `zmhostname` zimbraMtaMyNetworks

  5. #5
    SamTzu's Avatar
    SamTzu is offline Loyal Member
    Join Date
    Jan 2006
    Location
    Finland
    Posts
    83
    Rep Power
    9

    Default

    Here is sample from the log files...

    Jul 17 09:32:43 zimbra-list1 amavis[6437]: (06437-01) ESMTP::10024 /opt/zimbra/data/amavisd/tmp/amavis-20090717T093243-06437: <Brian_Maria652@ms9.hinet.net> -> <graces89@yahoo.com.tw>,<gracesaly@yahoo.com.tw>,< gracesasa2000@yahoo.com.tw>,<graceschoolther@yahoo .com.tw>,<gracescop@yahoo.com.tw>,<gracesctsao@yah oo.com.tw>,<gracescully@yahoo.com.tw>,<graceself@y ahoo.com.tw>,<gracesgw1216@yahoo.com.tw>,<gracesh2 002@yahoo.com.tw>,<gracesh888@yahoo.com.tw>,<grace shan63@yahoo.com.tw>,<graceshaw@yahoo.com.tw>,<gra ceshe1101@yahoo.com.tw>,<graceshea0317@yahoo.com.t w>,<graceshen_0706@yahoo.com.tw> SIZE=952 BODY=8BITMIME Received: from zimbra-list1.our-domain.com ([127.0.0.1]) by localhost (zimbra-list1.our-domain.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP; Fri, 17 Jul 2009 09:32:43 +0300 (EEST)
    Jul 17 09:32:43 zimbra-list1 amavis[6437]: (06437-01) Checking: xNLJU7+LUmOY [10.10.11.1] <Brian_Maria652@ms9.hinet.net> -> <graces89@yahoo.com.tw>,<gracesaly@yahoo.com.tw>,< gracesasa2000@yahoo.com.tw>,<graceschoolther@yahoo .com.tw>,<gracescop@yahoo.com.tw>,<gracesctsao@yah oo.com.tw>,<gracescully@yahoo.com.tw>,<graceself@y ahoo.com.tw>,<gracesgw1216@yahoo.com.tw>,<gracesh2 002@yahoo.com.tw>,<gracesh888@yahoo.com.tw>,<grace shan63@yahoo.com.tw>,<graceshaw@yahoo.com.tw>,<gra ceshe1101@yahoo.com.tw>,<graceshea0317@yahoo.com.t w>,<graceshen_0706@yahoo.com.tw>
    Jul 17 09:32:46 zimbra-list1 amavis[6437]: (06437-01) Blocked SPAM, LOCAL [10.10.11.1] [10.10.11.1] <Brian_Maria652@ms9.hinet.net> -> <graces89@yahoo.com.tw>,<gracesaly@yahoo.com.tw>,< gracesasa2000@yahoo.com.tw>,<graceschoolther@yahoo .com.tw>,<gracescop@yahoo.com.tw>,<gracesctsao@yah oo.com.tw>,<gracescully@yahoo.com.tw>,<graceself@y ahoo.com.tw>,<gracesgw1216@yahoo.com.tw>,<gracesh2 002@yahoo.com.tw>,<gracesh888@yahoo.com.tw>,<grace shan63@yahoo.com.tw>,<graceshaw@yahoo.com.tw>,<gra ceshe1101@yahoo.com.tw>,<graceshea0317@yahoo.com.t w>,<graceshen_0706@yahoo.com.tw>, Message-ID: <e5920591a7d6e3937648f4290273ebf4@localhost.locald omain>, mail_id: xNLJU7+LUmOY, Hits: 18.773, size: 952, 3675 ms
    Jul 17 09:32:46 zimbra-list1 amavis[6437]: (06437-01) extra modules loaded: /opt/zimbra/zimbramon/lib/i486-linux-gnu-thread-multi/auto/Net/SSLeay/autosplit.ix, /opt/zimbra/zimbramon/lib/i486-linux-gnu-thread-multi/auto/Net/SSLeay/randomize.al, IO/Socket/SSL.pm, Net/LDAP/Extension.pm, Net/SSLeay.pm
    SamTzu
    -----------------------------------------------
    "I keep hitting the esc key, why am I still here?"

  6. #6
    SamTzu's Avatar
    SamTzu is offline Loyal Member
    Join Date
    Jan 2006
    Location
    Finland
    Posts
    83
    Rep Power
    9

    Default

    Looks normal.

    root@zimbra-list1:/var/log# su zimbra
    zimbra@zimbra-list1:/var/log$ zmprov gs `zmhostname` zimbraMtaMyNetworks
    # name zimbra-list1.our-domain.com
    zimbraMtaMyNetworks: 127.0.0.0/8 10.10.11.0/24
    SamTzu
    -----------------------------------------------
    "I keep hitting the esc key, why am I still here?"

  7. #7
    uxbod's Avatar
    uxbod is offline Moderator
    Join Date
    Nov 2006
    Location
    UK
    Posts
    8,016
    Rep Power
    24

    Default

    Well check if your server is a open relay and if not it maybe that a account has been compromised so also check /opt/zimbra/log/audit.log for any erroneous account activity.

  8. #8
    SamTzu's Avatar
    SamTzu is offline Loyal Member
    Join Date
    Jan 2006
    Location
    Finland
    Posts
    83
    Rep Power
    9

    Default

    I actually tried that...

    su - zimbra
    postsuper -d ALL
    postsuper: fatal: use of this command is reserved for the superuser
    SamTzu
    -----------------------------------------------
    "I keep hitting the esc key, why am I still here?"

  9. #9
    uxbod's Avatar
    uxbod is offline Moderator
    Join Date
    Nov 2006
    Location
    UK
    Posts
    8,016
    Rep Power
    24

    Default

    Oops As root
    Code:
    /opt/zimbra/postfix/sbin/postsuper -c /opt/zimbra/postfix/conf -d ALL

  10. #10
    SamTzu's Avatar
    SamTzu is offline Loyal Member
    Join Date
    Jan 2006
    Location
    Finland
    Posts
    83
    Rep Power
    9

    Default

    Much better, thx.
    SamTzu
    -----------------------------------------------
    "I keep hitting the esc key, why am I still here?"

Page 1 of 3 123 LastLast

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Similar Threads

  1. [SOLVED] Close to despair: LDAP installation problem!?
    By Xeronimo1974 in forum Installation
    Replies: 4
    Last Post: 07-17-2009, 09:10 AM
  2. Replies: 7
    Last Post: 01-21-2009, 12:48 AM
  3. [SOLVED] Problem with ldap on installation zimbra
    By yuranchik in forum Installation
    Replies: 1
    Last Post: 12-12-2007, 02:51 AM
  4. Debian installation of 4.5.10 with logger problem
    By firefox32 in forum Installation
    Replies: 3
    Last Post: 11-30-2007, 06:28 AM
  5. Replies: 16
    Last Post: 09-07-2006, 06:39 AM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •